I am in the process of implementing Exploit Guard in our W10 corporate image. I configured it using the GPO "Use a common set of exploit protection settings" that makes use of a XML file. Initially, Chrome.exe was not included in the XML file.

I realized that when I opened Chrome, an event ID 10 appeared in
Application and Service Logs -> Microsoft -> Windows -> Security Mitigations -> Kernel mode

Process '\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe' (PID 9740) was blocked from making system calls to Win32k.sys.

I even explicitly included chrome.exe as an exception in the Program Setting list, forcing OFF in the setting "Disable Win32 system calls". To do that, I just added this code to the XML file:

<AppConfig Executable="chrome.exe">     
   <SystemCalls> DisableWin32kSystemCalls="false"/>   

But nothing changes, and the same event ID appears. One interesting thing is that Chrome seems to work fine, with no error windows or crashes.

Any idea how to solve this situation?

  • Run Chrome and then in PowerShell enter the command Get-ProcessMitigation -Name chrome -RunningProcesses. Look under "System Call:" and let us know your settings. On mine it says "DisableWin32kSystemCalls : OFF, Audit : OFF, Override SystemCall : False". If yours is different, please share exactly how and where you Win32k System Calls. – harrymc Feb 11 at 10:14
  • I also have "System Call:DisableWin32kSystemCalls: OFF Audit: OFF Override SystemCall : False, and I still see the event appearing every time I open Chrome. You dont have the event? maybe another GPO setting provoking this behaviour? – YaKs Feb 11 at 10:53

To my great surprise I have the same warning.

To my greater surprise, I also have this same warning for browser_broker.exe, which is a component of Microsoft Edge. As its name suggests, this is probably the component that decides which browser to call for a URL.

Since this warning is happening on Microsoft's own software when it's working correctly, and is also happening on Chrome when it's working correctly, I think that it is harmless and unavoidable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.